メニュー
Apply when reviewing a pull request in Hyperledger Cacti. Covers PR scope, Conventional Commits, TypeScript conventions, public API surface, testing, security (OWASP Top 10), AI slop detection, and CI status.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
SOC 職業分類に基づく
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/hyperledger-cacti/cacti --skill code-reviewコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SKILL.md を表示中
10-step checklist for safely removing one or more packages from the Cacti monorepo. Covers inventory, dependency scan, TypeScript import audit, CI workflow cleanup, tsconfig references, test-tooling helpers, directory deletion, lockfile regeneration, tracking-doc update, and verification pass.
Triage Cacti CI failures on a PR or main branch, fetch failing job logs via gh CLI, categorize root causes, and produce a structured markdown report at docs/ci-reports/. Use when the user asks why CI is failing, asks for a CI failure report, references a failing PR or run, mentions GitHub Actions failures, or asks to analyze/diagnose pipeline issues in the Hyperledger Cacti monorepo.
Analyze code for common vulnerability patterns using CodeQL-style queries. Identify injection flaws, unsafe deserialization, prototype pollution, path traversal, and other security issues in TypeScript/JavaScript code.
| name | code-review |
| description | Apply when reviewing a pull request in Hyperledger Cacti. Covers PR scope, Conventional Commits, TypeScript conventions, public API surface, testing, security (OWASP Top 10), AI slop detection, and CI status. |
Review every PR against this checklist. Prioritize blocking issues over nits. Leave a comment only when you have a concrete, actionable suggestion. Do not approve a PR — human maintainer approval is required.
| # | Check | Goal | Reference |
|---|---|---|---|
| 1 | PR scope | One logical unit; no bundled unrelated concerns | PULL.md §1–2 |
| 2 | Conventional Commits | Header ≤ 72 chars; correct type prefix; PR title matches linked issue | CONVENTIONS.md §8 |
| 3 | TypeScript conventions | I prefix on interfaces; no any/console.log/eval; Prettier format | CONVENTIONS.md §5 |
| 4 | Public API surface | New types in public-api.ts; no manual edits to generated/ | CONVENTIONS.md §4 |
| 5 | Package conventions | cacti- prefix; tsconfig.base.json extended; cactus-test-tooling devDep only | CONVENTIONS.md §3–4 |
| 6 | Testing | Failing test for every behaviour change; port 0; no coverage bloat | CONVENTIONS.md §7, PULL.md §3 |
| 7 | Security (OWASP Top 10) | No secrets/injection/permissive CORS/verbose errors; SHA-pinned Actions | SECURITY.md |
| 8 | AI slop | No restatement comments, single-caller abstractions, hallucinated APIs | AI_GUIDELINES.md |
| 9 | CI status | Fetch the PR's actual check-run results; report any failing checks | PR state |
Flag the following as requiring resolution before merge:
// increment i by 1 above i++.data, result, obj, handler where a domain name is possible.Blocking / Required / NitCI for check-run failures)Do not post a comment without a concrete suggestion.